Design a solution to log and monitor Azure resources

1. What are the two fundamental data types Azure Monitor collects?

A. Metrics are numeric time series; logs are records with properties, stored in Log Analytics.

2. You need to know who deleted a resource group yesterday. Which data source?

B. The activity log records control-plane operations on the subscription: who did what, when.

3. Storage account resource logs (read/write requests) must be analyzed with KQL. What do you configure?

C. Resource logs aren't collected until you create a diagnostic setting for them.

4. Which agent collects guest OS logs and performance data from VMs into Log Analytics?

C. The Azure Monitor agent (AMA) replaced the legacy MMA agent, which is retired. Data collection rules define what to collect.

5. How long are platform metrics kept by default?

C. Platform metrics are stored for 93 days. Send them to a workspace for longer retention or log-style queries.

6. Application performance, dependencies and failed requests of a web app must be monitored. Which feature?

B. Application Insights is Azure Monitor's APM feature for application-level telemetry.

7. What's Microsoft's recommended starting point for the number of Log Analytics workspaces?

C. A single workspace is simpler to query and manage. Add workspaces for data sovereignty, billing or access isolation.

8. Data from EU and US resources must stay in its own region for compliance. What workspace design?

B. Data residency requirements are a main reason for multiple workspaces.

9. App teams may only see logs of their own resources in a shared workspace. Which access mode?

D. With resource-context access, users see logs for resources they have permissions on, without workspace-wide rights.

10. Which access control mode should the workspace use to allow resource-context permissions?

C. This setting lets users with resource permissions query their resources' logs.

11. A workspace ingests 200 GB per day. How do you reduce the cost of a stable volume?

D. Commitment tiers give a discount for a fixed daily volume compared to pay-as-you-go.

12. High-volume verbose logs are only needed for occasional troubleshooting. Cheapest design?

A. Basic/Auxiliary logs cost far less to ingest, with limited querying. Analytics logs are for data you query often.

13. Logs must be kept for 7 years for audit, rarely queried. What do you use?

A. Archive/long-term retention keeps data cheaply; you restore or search it when needed.

14. You need an interactive report that combines metrics, log queries and text, shared with the operations team. Which tool?

D. Workbooks combine text, KQL queries, metrics and parameters into interactive reports.

15. What are Azure Monitor insights (VM insights, Container insights, ...)?

C. Insights give a preconfigured view for a resource type, so you don't build it from scratch.

16. Which visualization tool is best for a wall-mounted NOC dashboard with data from many sources, including non-Azure ones?

B. Grafana is strong for multi-source operational dashboards; Workbooks are best for Azure-native interactive reports.

17. Billions of telemetry events from IoT devices must be explored interactively in near real time. Which service?

B. Azure Data Explorer is a fast, scalable analytics engine for large volumes of log and telemetry data, queried with KQL.

18. Which query language do Log Analytics and Azure Data Explorer share?

A. Both use KQL; Log Analytics workspaces are built on the same engine as Azure Data Explorer.

19. An alert must fire when CPU on any VM stays above 90% for 15 minutes. Which alert type?

D. Metric alerts evaluate numeric metrics against thresholds, near real time.

20. The same email and Teams notifications must be reused across 40 alert rules. What do you design?

B. Action groups are reusable sets of notifications and actions.